Skip to content

Commit 0ec6a48

Browse files
ldionneldionne
committed
[libc++] Fix potential OOB in poisson_distribution
See details in the original Chromium bug report: https://bugs.chromium.org/p/chromium/issues/detail?id=994957
1 parent 69ce2ae commit 0ec6a48

File tree

3 files changed

+98
-22
lines changed

3 files changed

+98
-22
lines changed

‎libcxx/include/random

+24-21
Original file line numberDiff line numberDiff line change
@@ -4592,7 +4592,10 @@ public:
45924592

45934593
template<class _IntType>
45944594
poisson_distribution<_IntType>::param_type::param_type(double __mean)
4595-
: __mean_(__mean)
4595+
// According to the standard `inf` is a valid input, but it causes the
4596+
// distribution to hang, so we replace it with the maximum representable
4597+
// mean.
4598+
: __mean_(isinf(__mean) ? numeric_limits<double>::max() : __mean)
45964599
{
45974600
if (__mean_ < 10)
45984601
{
@@ -4610,7 +4613,7 @@ poisson_distribution<_IntType>::param_type::param_type(double __mean)
46104613
{
46114614
__s_ = _VSTD::sqrt(__mean_);
46124615
__d_ = 6 * __mean_ * __mean_;
4613-
__l_ = static_cast<result_type>(__mean_ - 1.1484);
4616+
__l_ = std::trunc(__mean_ - 1.1484);
46144617
__omega_ = .3989423 / __s_;
46154618
double __b1_ = .4166667E-1 / __mean_;
46164619
double __b2_ = .3 * __b1_ * __b1_;
@@ -4627,12 +4630,12 @@ template<class _URNG>
46274630
_IntType
46284631
poisson_distribution<_IntType>::operator()(_URNG& __urng, const param_type& __pr)
46294632
{
4630-
result_type __x;
4633+
double __tx;
46314634
uniform_real_distribution<double> __urd;
46324635
if (__pr.__mean_ < 10)
46334636
{
4634-
__x = 0;
4635-
for (double __p = __urd(__urng); __p > __pr.__l_; ++__x)
4637+
__tx = 0;
4638+
for (double __p = __urd(__urng); __p > __pr.__l_; ++__tx)
46364639
__p *= __urd(__urng);
46374640
}
46384641
else
@@ -4642,19 +4645,19 @@ poisson_distribution<_IntType>::operator()(_URNG& __urng, const param_type& __pr
46424645
double __u;
46434646
if (__g > 0)
46444647
{
4645-
__x = static_cast<result_type>(__g);
4646-
if (__x >= __pr.__l_)
4647-
return __x;
4648-
__difmuk = __pr.__mean_ - __x;
4648+
__tx = std::trunc(__g);
4649+
if (__tx >= __pr.__l_)
4650+
return std::__clamp_to_integral<result_type>(__tx);
4651+
__difmuk = __pr.__mean_ - __tx;
46494652
__u = __urd(__urng);
46504653
if (__pr.__d_ * __u >= __difmuk * __difmuk * __difmuk)
4651-
return __x;
4654+
return std::__clamp_to_integral<result_type>(__tx);
46524655
}
46534656
exponential_distribution<double> __edist;
46544657
for (bool __using_exp_dist = false; true; __using_exp_dist = true)
46554658
{
46564659
double __e;
4657-
if (__using_exp_dist || __g < 0)
4660+
if (__using_exp_dist || __g <= 0)
46584661
{
46594662
double __t;
46604663
do
@@ -4664,31 +4667,31 @@ poisson_distribution<_IntType>::operator()(_URNG& __urng, const param_type& __pr
46644667
__u += __u - 1;
46654668
__t = 1.8 + (__u < 0 ? -__e : __e);
46664669
} while (__t <= -.6744);
4667-
__x = __pr.__mean_ + __pr.__s_ * __t;
4668-
__difmuk = __pr.__mean_ - __x;
4670+
__tx = std::trunc(__pr.__mean_ + __pr.__s_ * __t);
4671+
__difmuk = __pr.__mean_ - __tx;
46694672
__using_exp_dist = true;
46704673
}
46714674
double __px;
46724675
double __py;
4673-
if (__x < 10)
4676+
if (__tx < 10 && __tx >= 0)
46744677
{
46754678
const double __fac[] = {1, 1, 2, 6, 24, 120, 720, 5040,
46764679
40320, 362880};
46774680
__px = -__pr.__mean_;
4678-
__py = _VSTD::pow(__pr.__mean_, (double)__x) / __fac[__x];
4681+
__py = _VSTD::pow(__pr.__mean_, (double)__tx) / __fac[static_cast<int>(__tx)];
46794682
}
46804683
else
46814684
{
4682-
double __del = .8333333E-1 / __x;
4685+
double __del = .8333333E-1 / __tx;
46834686
__del -= 4.8 * __del * __del * __del;
4684-
double __v = __difmuk / __x;
4687+
double __v = __difmuk / __tx;
46854688
if (_VSTD::abs(__v) > 0.25)
4686-
__px = __x * _VSTD::log(1 + __v) - __difmuk - __del;
4689+
__px = __tx * _VSTD::log(1 + __v) - __difmuk - __del;
46874690
else
4688-
__px = __x * __v * __v * (((((((.1250060 * __v + -.1384794) *
4691+
__px = __tx * __v * __v * (((((((.1250060 * __v + -.1384794) *
46894692
__v + .1421878) * __v + -.1661269) * __v + .2000118) *
46904693
__v + -.2500068) * __v + .3333333) * __v + -.5) - __del;
4691-
__py = .3989423 / _VSTD::sqrt(__x);
4694+
__py = .3989423 / _VSTD::sqrt(__tx);
46924695
}
46934696
double __r = (0.5 - __difmuk) / __pr.__s_;
46944697
double __r2 = __r * __r;
@@ -4708,7 +4711,7 @@ poisson_distribution<_IntType>::operator()(_URNG& __urng, const param_type& __pr
47084711
}
47094712
}
47104713
}
4711-
return __x;
4714+
return std::__clamp_to_integral<result_type>(__tx);
47124715
}
47134716

47144717
template <class _CharT, class _Traits, class _IntType>

‎libcxx/test/std/numerics/rand/rand.dis/rand.dist.bern/rand.dist.bern.geo/eval.pass.cpp

+11
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,16 @@ sqr(T x)
3030
return x * x;
3131
}
3232

33+
void test_small_inputs() {
34+
std::mt19937 engine;
35+
std::geometric_distribution<std::int16_t> distribution(5.45361e-311);
36+
typedef std::geometric_distribution<std::int16_t>::result_type result_type;
37+
for (int i = 0; i < 1000; ++i) {
38+
volatile result_type res = distribution(engine);
39+
((void)res);
40+
}
41+
}
42+
3343
void
3444
test1()
3545
{
@@ -296,6 +306,7 @@ int main(int, char**)
296306
test4();
297307
test5();
298308
test6();
309+
test_small_inputs();
299310

300311
return 0;
301312
}

‎libcxx/test/std/numerics/rand/rand.dis/rand.dist.pois/rand.dist.pois.poisson/eval.pass.cpp

+63-1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,67 @@ sqr(T x)
3030
return x * x;
3131
}
3232

33+
void test_bad_ranges() {
34+
// Test cases where the mean is around the largest representable integer for
35+
// `result_type`. These cases don't generate valid poisson distributions, but
36+
// at least they don't blow up.
37+
std::mt19937 eng;
38+
39+
{
40+
std::poisson_distribution<std::int16_t> distribution(32710.9);
41+
for (int i=0; i < 1000; ++i) {
42+
volatile std::int16_t res = distribution(eng);
43+
((void)res);
44+
}
45+
}
46+
{
47+
std::poisson_distribution<std::int16_t> distribution(std::numeric_limits<std::int16_t>::max());
48+
for (int i=0; i < 1000; ++i) {
49+
volatile std::int16_t res = distribution(eng);
50+
((void)res);
51+
}
52+
}
53+
{
54+
std::poisson_distribution<std::int16_t> distribution(
55+
static_cast<double>(std::numeric_limits<std::int16_t>::max()) + 10);
56+
for (int i=0; i < 1000; ++i) {
57+
volatile std::int16_t res = distribution(eng);
58+
((void)res);
59+
}
60+
}
61+
{
62+
std::poisson_distribution<std::int16_t> distribution(
63+
static_cast<double>(std::numeric_limits<std::int16_t>::max()) * 2);
64+
for (int i=0; i < 1000; ++i) {
65+
volatile std::int16_t res = distribution(eng);
66+
((void)res);
67+
}
68+
}
69+
{
70+
// We convert `INF` to `DBL_MAX` otherwise the distribution will hang.
71+
std::poisson_distribution<std::int16_t> distribution(std::numeric_limits<double>::infinity());
72+
for (int i=0; i < 1000; ++i) {
73+
volatile std::int16_t res = distribution(eng);
74+
((void)res);
75+
}
76+
}
77+
{
78+
std::poisson_distribution<std::int16_t> distribution(0);
79+
for (int i=0; i < 1000; ++i) {
80+
volatile std::int16_t res = distribution(eng);
81+
((void)res);
82+
}
83+
}
84+
{
85+
// We convert `INF` to `DBL_MAX` otherwise the distribution will hang.
86+
std::poisson_distribution<std::int16_t> distribution(-100);
87+
for (int i=0; i < 1000; ++i) {
88+
volatile std::int16_t res = distribution(eng);
89+
((void)res);
90+
}
91+
}
92+
}
93+
3394
int main(int, char**)
3495
{
3596
{
@@ -150,5 +211,6 @@ int main(int, char**)
150211
assert(std::abs((kurtosis - x_kurtosis) / x_kurtosis) < 0.01);
151212
}
152213

153-
return 0;
214+
test_bad_ranges();
215+
return 0;
154216
}

0 commit comments

Comments
 (0)